55c2faf7a200fe2db176dd0a7c43bd8f97d4a485814d6b105855ae7adfadcb32

Resubmissions

25-03-2023 13:21

230325-ql3nzacg96 3

25-03-2023 12:34

230325-pr8azaeg8x 10

Analysis

max time kernel
490s
max time network
493s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2023 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BruteL4 DDOS Tool.exe
Size

12.0MB
MD5

7469696e71e96dd67ce6c5f59c2e77c7
SHA1

a26de444a133d56eb51f5bac21fb2f925b5ee37a
SHA256

55c2faf7a200fe2db176dd0a7c43bd8f97d4a485814d6b105855ae7adfadcb32
SHA512

7702b5c08999a52816ff0176efe14f7d3c3808081337077f4fd4154cd29d3641aca5508d37c10e44d1980f835c868e9f2d3c71fda23f89c9ff80ca0f238f4c4c
SSDEEP

393216:J+aZeyhEOh8pJpdEYTzuaj5DDKEeuuODGfTc:MahEe8pVEY3uaJWEhuODGw

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

BruteL4 DDOS Tool.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	BruteL4 DDOS Tool.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	BruteL4 DDOS Tool.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

BruteL4 DDOS Tool.exe

pid process

4900 BruteL4 DDOS Tool.exe
4900 BruteL4 DDOS Tool.exe

pid	process
4900	BruteL4 DDOS Tool.exe
4900	BruteL4 DDOS Tool.exe

C:\Users\Admin\AppData\Local\Temp\BruteL4 DDOS Tool.exe
"C:\Users\Admin\AppData\Local\Temp\BruteL4 DDOS Tool.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4900

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads